How Police Took Down the Kratos Phishing Kit Targeting Microsoft 365

Robert Moore · 2026-07-22

German and US law enforcement have dismantled the core infrastructure of Kratos, a phishing kit that cybercriminals used to steal Microsoft 365 sessions and bypass multi-factor authentication (MFA). Indonesian authorities also arrested the alleged developer and operator of this kit, which German investigators described as one of the world's most widely used criminal tools. In a joint announcement on Monday, the Frankfurt public prosecutor's cybercrime unit (ZIT) and Germany's Federal Criminal Police Office (BKA) revealed the takedown. This operation highlights the growing threat of sophisticated phishing kits that target cloud-based productivity suites like Microsoft 365, which millions of US businesses rely on daily. ### What Made Kratos So Dangerous? Kratos wasn't your typical phishing kit. It was designed to steal session cookies, which are like digital keys that keep you logged into your accounts. By grabbing these cookies, attackers could bypass MFA entirely. That means even if you had a strong password and a second factor like a text code, Kratos could still get in. The kit was sold on underground forums for about $200 to $500, a bargain for cybercriminals looking to break into corporate networks. Once inside, they could access emails, files, and other sensitive data without raising red flags. This made it a favorite among ransomware gangs and data thieves. ### Why Microsoft 365 Was a Prime Target Microsoft 365 is the backbone of many US businesses. From small startups to Fortune 500 companies, everyone uses it for email, collaboration, and storage. Attackers knew that compromising one account could lead to a domino effect. They could impersonate employees, send fake invoices, or launch further attacks. The Kratos kit specifically targeted the login flow of Microsoft 365. It mimicked legitimate login pages to trick users into entering their credentials. But the real kicker was the cookie theft. Even after users entered their MFA codes, the kit captured the session token, giving attackers persistent access. ### How Law Enforcement Took It Down The takedown involved a coordinated effort between German, US, and Indonesian authorities. They seized servers, domains, and infrastructure used to distribute and operate Kratos. The alleged developer, a 25-year-old Indonesian man, was arrested and faces charges related to computer fraud and money laundering. This operation sends a clear message: cybercriminals aren't safe anywhere. But it also underscores the need for better defenses. Phishing kits like Kratos evolve fast, and traditional security measures often fall short. ### What This Means for US Businesses If you rely on Microsoft 365, this takedown is good news, but it's not a reason to let your guard down. Here are a few steps you can take to protect your organization: - **Use phishing-resistant MFA**: Hardware keys or biometric authentication are harder to bypass than SMS codes. - **Monitor for session anomalies**: Look for logins from unusual locations or devices. - **Train employees regularly**: Simulated phishing tests can help staff spot fake login pages. - **Keep software updated**: Patches often fix vulnerabilities that kits like Kratos exploit. ### The Bigger Picture Kratos was just one of many phishing kits circulating in the criminal underground. Its takedown is a win, but the threat landscape remains crowded. Cybercriminals are always looking for new ways to steal credentials and bypass security. That's why staying informed and proactive is key. For professionals in the antidetect browser space, this case is a reminder of how attackers use sophisticated tools to evade detection. Antidetect browsers, which help mask digital fingerprints, are often used by both ethical researchers and cybercriminals. Understanding these technologies can help you build better defenses. ### Final Thoughts The Kratos takedown shows that international cooperation can disrupt major cybercrime operations. But it also highlights the importance of layered security. No single tool can protect you from everything. By combining strong authentication, user training, and monitoring, you can reduce the risk of falling victim to the next big phishing kit. Stay safe out there, and keep your sessions locked down.